Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity

Round 1

Reviewer 1 Report

In this study, from the point of view of post-response, authors propose a structure that can monitor file access in real time. Because the proposed structure enforces a monitoring policy in the kernel, the user cannot bypass this monitoring function. The topic is interesting, and writing is well. However, the innovations regarding paper should be compared, such as simulation and experiment. Meanwhile, HIL can be regarded as a good tool to verify the performance regarding this paper, which is reported through reduced-order aggregate model for large-scale converters with inhomogeneous initial conditions in dc microgrids. Meanwhile, the writing errors should be corrected in the revised version.

Author Response

Thanks for your journal review.

After checking your review comments, we thought about many parts of our journal. We have supplemented a lot of journal contents based on your review comments. We revised the description of the research design and supplemented the verify method. We re-verified the performance to highlight the performance advantages of the structure proposed in this study.

We have accepted all your review comments. However, some of your comments were not suitable for this research method, so they were responded in a different way.

By your review, we were able to improve the quality of our journal.

Modifications are indicated in blue.

We thank you again for your review.

Reviewer 2 Report

Try to avoid acronyms without explanation before use it (in line 11 is better to write “Intrusion detection systems (IDS) and intrusion prevention systems (IPS)”, instead “IDS/IPS”).

The implemented functions have the equations presented, but a code sequence for one of the functions would have been of interest.

Compared to the pre-existing file monitoring capabilities, the method implemented by the 4 functions seems to be more efficient (in terms of processing speed and CPU usage).

However, both the CPU difference usage (~0.2%) and the scan times difference (1ms) are not exceptionally different. The proposed method have more favorable performances, but perhaps more tests in different conditions would have been desirable. For example proposed malware detection code must be tested on computing machines with different configurations and structures and the result must be compared.

Author Response

Thanks for your journal review.

After checking your review comments, we thought about many parts of our journal. We have supplemented a lot of journal contents based on your review comments. We revised the description of the research design and supplemented the verify method. We re-verified the performance to highlight the performance advantages of the structure proposed in this study.

We have accepted all your review comments. However, some of your comments were not suitable for this research method, so they were responded in a different way.

By your review, we were able to improve the quality of our journal.

Modifications are indicated in blue.

We thank you again for your review.

Round 2

Reviewer 1 Report

The comments have been solved